chore(sidecars): re-add EXPOSE with documentation comment

Reverts the earlier removal — EXPOSE is doc-only on the
renderer-driven publish path, but keeping it in the Dockerfile
(with the comment naming it as such) documents the bundle's
port surface for anyone reading the file.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Dockerfile.sidecars

@@ -95,6 +95,10 @@ RUN mkdir -p \
       /run/supervise/queue \
       /home/mitmproxy/.mitmproxy
 
+# Documentation only — the compose renderer publishes whichever
+# subset the bottle uses.
+EXPOSE 8888 9099 9418 9100
+
 # WORKDIR matches Dockerfile.supervise's prior layout so the
 # in-app same-dir import in supervise_server.py stays deterministic.
 WORKDIR /app